Apparatus and methods for controlling and communicating with downhole devices

ABSTRACT

Apparatus and methods for controlling and communicating with one or more tools in a downhole tool string including a tractor, an auxiliary tractor tool, a logging tool, a safety sub, a release mechanism, a unit containing sensors for monitoring downhole conditions, a setting tool, and a perforating gun. Also provided are apparatus and methods for controlling and communicating with one or more perforating guns, release devices, and explosive devices in a string to be lowered into a wellbore. Control and communication are accomplished by sending signals from the surface to control switches in the control units on the tool, with redundant switches for safety, to state machines in the respective control units, “each state machine returning a signal verifying switch status to the surface. Control and power functions are accomplished with voltage of different polarities for safety.

RELATED APPLICATIONS

This application is a continuation of U.S. non-provisional patentapplication Ser. No. 12/221,611 filed on Aug. 5, 2008 which is acontinuation-in-part of International Application No. PCTIUS200S/00200,TRACTOR COMMUNICATION/CONTROL AND SELECT FIRE PERFORATING SWITCH, filedJan. 7, 2008, which related patent application is hereby incorporated inits entirety by this specific reference thereto.

BACKGROUND OF THE INVENTION

Perforating guns are used to complete an oil or gas well by creating aseries of tunnels through the casing into the formation, allowinghydrocarbons to flow into the wellbore. Such operations can involvemultiple guns that create separate perforations in multiple producingzones where, each gun is fired separately. Operations can also involvesingle or multiple guns in conjunction with setting a plug. The guns aretypically conveyed to the producing zone(s) by wireline, tubing ordownhole tractors.

Switches are typically coupled to each detonator or igniter in a stringof guns to determine the sequence of firing. One type of switch uses adiode that allows two guns (or a gun and a plug) to be fired, one withpositive and the other with negative voltage. Percussion switches aremechanical devices that use the force of detonation of one gun toconnect electrically to the next gun, starting with the bottom gun andworking up, and are typically used to selectively fire three or moreguns. The devices also disconnect from the gun just fired, preventingthe wireline from shorting out electrically. A problem with percussionswitches is that if any switch in the string fails to actuate, thefiring sequence cannot continue, and the string must be pulled from thewellbore, redressed and run again.

More recently, electronic switches have been used in select-fire guns.Unlike percussion-actuated mechanical switches, selective firing ofguns, continues in the event of a misfired gun or a gun that cannot befired because it is flooded with wellbore fluid. One commercial switchof this type has downlink communication but is limited in the number ofindividual guns that can be fired in one run. As with the percussionswitches, the system relies on detecting changes in current at thesurface to identify gun position, which may not be a reliable method toidentify gun position in a changing environment.

Another type of electronic switch has both downlink and uplinkcommunication and is not as limited in total number of guns that can befiled in a, run, but is somewhat slow to fire because of the longbi-directional bit sequence required for communication. Both downlinkand uplink communications use a unique address associated with eachswitch to identify correct gun position prior to firing.

A common problem in operating downhole devices is keeping unwanted powerfrom causing catastrophic action. Examples include a perforating gunreceiving voltage that accidentally fires the gun downhole, a settingtool being activated prematurely, a release device suddenly deploying,and high voltage destroying electronics in a well logging tool becausethe power rating is exceeded. A solution to this problem is to stopunwanted power by inserting a blocking mechanism between the powersupply and the downhole device to be protected. In a standardperforating job, the power to log and to detonate the perforating gun islocated at the surface. Power can also be generated downhole usingbatteries. Recently, there have been detonator designs that incorporateelectronics to block unwanted power from firing a gun.

The high voltage needed to power a downhole tractor presents particularproblems protecting the tool string conveyed by the tractor. The surfacevoltages powering a tractor are typically 1500 VDC or 1000 VAC. Tractorsnormally have an internal design that prevents tractor power from beingtransmitted below the tractor, but sometimes the circuitry fails or doesnot work properly, allowing induced voltage or direct voltage to passthrough the tractor into the tool string below. To protect the toolstring, which can include perforating guns or logging tools, one or morespecial safety subs are located between it and the tractor. Some of thesubs use electrical/mechanical relays to block accidental tractor power;others use electronic switches that are commanded to turn off and onusing communication messages from the surface that contain a uniqueaddress.

More recently, the American Petroleum Institute (API) has issued arecommended practice for safe tractor operations, RP 67, that includes arecommendation that the tractor be designed to block unwanted voltagefrom passing through and that the design is free of any single pointfailure. In addition, there must be an independent, certified blockingdevice between the tractor and any perforating gun to prevent unwantedpower from being applied to a gun.

BRIEF SUMMARY OF EXAMPLES OF THE INVENTION

An object of the present invention to provide a system that preventstractor power from migrating past the tractor. Elements of this designare employed in a separate safety sub that acts as a safety barrier toblock unwanted power to the tool string.

Another object of the present invention is to provide a command andresponse system featuring fast bi-directional communication whileallowing a large number of guns to be fired selectively. The systemrequires communication through a cable and can include communicationswith a downhole tractor and safety sub. Multiple embodiments areprovided using a state machine as part of the electrical switch tocommand and identify status within the switch. In one embodiment, thegun position before firing is uniquely identified by keeping track ofthe sequence of states. In the another, correct gun position isestablished by state and an uplink of a unique identifier. Unlikebi-directional communication electronic switches, a returned downlink ofthe identifier is not necessary.

Other objects of the present invention, and many advantages, will beclear to those skilled in the art from the description of the severalembodiment(s) of the invention and the drawings appended hereto. Thoseskilled in the art will also recognize that the embodiment(s) describedherein are only examples of specific embodiment(s), set out for thepurpose of describing the making and using of the present invention.

The present invention provides a system for bi-directional communicationwith a tractor that includes means for connecting and disconnectingelectrical power below the tractor. The system also allowsbi-directional communication to sensors contained in the tractor formonitoring certain operational functions. The communication and uplinkdata transmission can occur with tractor power either off or on. Aseparate safety sub uses common elements of the bi-directionalcommunication and switching to block unwanted voltage and to passallowable voltage. In addition, methods are disclosed for disconnectinga shorted wireline below the tractor or below the safety sub.

Also provided is a system for bi-directional communication with otherdevices such as selectively fired perforating guns, setting tools,release devices and downhole sensors including a system to select andfire specific guns in the sting. Each switch unit is interrogated andreturns a unique address that is retrieved under system control from thesurface. Each location within the gun string is identified with aparticular address.

In another aspect, the present invention provides an embodiment in whichevery switch unit is identical without an identifying address. Eachswitch unit's sequential position in the gun string is identified bykeeping proper track of the number of surface commands along with theuplink status from an embedded state machine. This predetermined chainof events provides surface information for determining the uniquelocation of each switch unit in a given gun string. These enhancementsallow for faster communication, initialization and firing time. As anadded feature, all switches are exactly the same with no unique embeddedaddress to program and manage.

Also provided is a method for controlling one or more devices on a toolstring in a wellbore with a surface computer and a surface controllercomprising the steps of sending a signal down a cable extending into thewellbore to one or more control units located on the devices on the toolstring, each control unit comprising a state machine for identifying thestatus of the control unit, processing the signal with the statemachine, controlling the position of one or more switches located on thedevice on the tool string when the state machine for the deviceprocesses a valid signal, and returning a signal validating switchaction to the surface computer.

In another aspect, a method is provided for switching wireline voltagebetween a tractor motor and the tractor output in a downhole tool stringincluding a tractor comprising the steps of sending a signal to acontrol unit on the tractor from the surface, processing the signal witha state machine on the tractor for controlling the position of one ormore switches located in one or more circuits connecting the wireline toeither the tractor motor or a through wire that connects to the toolstring; and returning a signal validating switch action to the surface.

Also provided is a method for switching between a safe mode fortractoring and a perforating mode for perforating in a tool stringincluding a tractor and a perforating gun that has been lowered into awell on a wireline comprising the steps of sending a signal to a controlunit on the tractor from the surface, processing the signal with a statemachine for controlling the position of one or more switches located inone or more circuits for connecting the wireline to either the tractormotor or a through wire connecting to the perforating gun, and returninga signal validating switch action to the surface.

Also provided is an explosive initiator integrated with a control unitcomprising means for receiving a signal from a cable, a microcontrollerincluding a state machine for validating a signal from the signalreceiving means, a switch responsive to an output from themicrocontroller when a signal is validated by the state machine; and anexplosive initiator connected to the switch.

In another aspect, the explosive initiator is integrated into a switchunit for use in connection with a perforating gun to be lowered into awellbore on a cable comprises means for receiving a downlink signalthrough a cable to which a perforating gun is to be lowered into awellbore, first and second transmitters operating at low and highcurrent levels for transmitting uplink signals through the cable, and amicroprocessor in electrical communication with the signal receivingmeans and the first and second transmitters that includes a statemachine for validating a signal from the signal receiving means and thatreturns an uplink signal using either the first or said secondtransmitter through the cable. A switch is responsive to an output fromthe microcontroller when a signal is validated by the state machine andan explosive initiator is operably connected to the switch.

In yet another aspect, the present invention provides an apparatus forchecking downhole tools function before lowering into a wellborecomprising a pre-check controller, electrical connections between thepre-check controller and one or more downhole tools, and one or morecontrol units mounted on each downhole tool that are adapted forbi-directional communication with the pre-check controller, each controlunit comprising a state machine for identifying the status of eachcontrol unit, the pre-check controller being adapted to send a pluralityof commands to the respective control units.

Also provided is a method for checking one or more devices in a toolstring before lowering the tool string into a wellbore comprising thesteps of sending a signal to control units located on the devices, eachcontrol unit comprising a state machine for identifying control unitstatus, and processing the signal with the state machine. The switch(es)located on the device is/are controlled when the state machine for thatdevice processes a valid signal and a signal validating switch action isreturned from the control unit.

Also provided is a communication system that allows serial and parallelcontrol of downhole devices including tractors, auxiliary lmctor tools,well logging tools, release mechanisms, and sensors. The advantage ofparallel control is that individual devices can be interrogated withoutgoing through a series path, thereby being more accessible. Each tool inthe parallel arrangement has a control unit that carries a toolidentifier as part of its uplink communication. A detonator thatcontains an integral switch unit is also provided.

Also provided is a system including several components as follows:

Tractor

-   -   1. Use of dual processors, each controlling a set of switches        for connecting a W/L to either a tractor motor or a tool below        for directing the wireline for powering the tractor power or        providing a direct through wire mode.    -   2. A Zener diode in series with the final output to de-couple        the wireline in case of a short, thereby allowing communication        to the micro in order to actuate a switch to disconnect a        shorted circuit to regain tractor functions.    -   3. An inline series transformer on the output of the tractor        with one end of the primary winding connecting directly to the        tractor output while the other end connecting to tools below. In        addition, the output end of the transformer primary is        capacitive coupled to ground. In the event of a shorted W/L, a        high frequency signal can be sent down the wireline and produce        power on    -   the transformer secondary for actuating a switch such as a        motorized piston switch    -   or a form C switch, thereby clearing the shorted wireline.    -   4. Voltage blocker to disconnect in the event of a short caused        by gun firing and allows a predetermined voltage to be applied        to the wireline without being connected to the gun string below.    -   5. Pre-selecting W/L switches within a tractor and remaining in        a fixed or latched position for further use by another service        operation.    -   6. Provide real time status for temperature.    -   7. Provide real time status for downhole voltage.    -   8. Gang switch for control and status in a piston contact        geometry.    -   9. Design applies to both AC or DC driven tractors.    -   10. Supports 2-way communication.    -   11. Receives downlink commands.    -   12. Transmits switch status.    -   13. Transmits sensor data (Temp, V, RPM, etc.).    -   14. No single point failures in Tractor itself    -   15. Complies with RPI 67.

Surface Controller

-   -   1. Wireless interface for sending and receiving data between a        laptop computer and a Surface Controller.    -   2. Laptop for providing control and human interface via special        program, monitoring system status, archiving data, recording job        history, and providing Bluetooth communication between Laptop        and Surface Controller.

3. Interfaces between Laptop and Tractor.

-   -   4. Sends commands and solicits data.

Surface Computer

-   -   1. Wireless connection to surface controller.    -   2. Monitor which power supply is connected between tractor or        perforating and run appropriate program.    -   3. Control tractor pre-check, tractor operations including        communications, sending commands, and power for performing.    -   4. Communicate using a power line carrier during tractor        operation with either AC or DC power.    -   5. Correlation (CCL) during tractor operation.

Safety Sub

-   -   1. Use of dual processors, each controlling a set of switches        for connecting a perforating gun string to either ground or to a        downhole W/L.

2. A Zener diode in series with the final output to de-couple thewireline in case of a short thereby allowing communication to themicrocontroller to actuate a switch to disconnect a shorted circuit toregain tractor functions.

3. Provide an inline transformer on the output of the Safety Sub havingthe output capacitive coupled to ground. In the event of a shorted W/L,a high frequency signal can be sent down the wireline and produce poweron the transformer secondary for actuating a switch such as a motorizedpiston switch or a form C switch, thereby clearing the shorted wireline,and produce power on the transformer secondary for actuating a pistonswitch and. clearing the shorted wireline in the same way as with thetractor.

-   -   4. Voltage blocker to disconnect in the event of a short caused        by gun firing and allows a predetermined voltage to be applied        to the wireline without being connected to the gun string below.    -   5. A wireless interface for sending and receiving data between a        laptop computer and a Surface Controller.    -   6. Pre-selecting Safe Sub W/L switches and remains in a fixed        position for further use by another service operation.    -   7. Supports two-way communication.    -   8. Receives Safe and Perf commands from surface.    -   9. Transmits switch status.    -   10. Independent Unit with no single point failures.    -   11. Uses same design as portion of tractor electronics.    -   12. Complies with RP67.

In yet another aspect, a switch unit is provided that is responsive todownlink communication signals for use in a perforating gun, releasedevice, or explosive device for lowering into a wellbore. The switchunit comprises a switch for activating the perforating gun, releasedevice, or explosive device, a microprocessor operably connected to theswitch, and first and second uplink communications transmittersoperating at low and high current levels, respectively, themicroprocessor selecting either the first or the second current leveltransmitter depending upon whether downlink communication signals aretransmitted before or after lowering into a wellbore.

Also provided is a method of communicating with a switch unit located ona perforating gun, release device, or explosive device for lowering intoa wellbore comprising the steps of sending a signal to the switch unit,processing the signal with a state machine comprising the switch unit,controlling the position of one or more switches comprising the switchunit, and returning a signal validating switch status from the switchunit at a current level in the range of from about 4 milliamps to about15 milliamps. The method contemplates the further step of increasing thecurrent level of the return signal after the perforating gun, releasedevice, or explosive device is lowered into the wellbore, and in oneembodiment, the current level is increased to a range of from about 10to about 100 milliamps.

Also provided is a method of switching between a safe mode fortractoring and a perforating mode in a tool string including a tractorand a perforating gun for lowering into a wellbore on a wirelinecomprising the steps of sending a signal to a control unit on thetractor, the control unit comprising a state machine for processing thesignal and controlling the position of a switch for connecting thewireline to either the tractor motor or a through wire connecting to theperforating gun while blocking negative voltage through the wireline,and returning a signal validating switch position to the surface.

BRIEF DESCRIPTION OF THE SEVERAL VIEWS OF THE DRAWINGS

FIG. 1 is a diagram of a tool string including a perforating gun string.

FIG. 2 is a block diagram of a Surface Controller.

FIG. 3A, shows a Surface Controller interfacing with a Tractor forproviding power and communications.

FIG. 3B shows a Surface Controller for checking Tractor functions only.

FIG. 3C shows a Surface Controller for checking only the Release Device,Sensors and select switches.

FIG. 4 shows a Pre-check Controller used in the pre-check shown in FIG.3.

FIG. 5 is a flow chart describing program control for performing apre-check on a gun string.

FIG. 6 is a block diagram of Tractor Controller electronics.

FIGS. 7A, 7B, 7C and 7D show a combination of positions for two sets ofform C switches.

FIG. 8 is a block diagram of various sensors within the tractorelectronics.

FIGS. 9A, 9B, and 9C are block diagrams of different embodiments of thecircuitry of a Safety Sub.

FIGS. 9D-1 and 9D-2 are block diagrams of a Safety Sub incorporating avoltage blocker.

FIG. 10 is a flow chart for a single State Machine.

FIG. 11 is a State Diagram for a single State Machine.

FIG. 12 is a block diagram for a Power Line Carrier Communication (PLCC)interface.

FIG. 13 shows a tool string that includes Switch Units in a gun string.

FIG. 14A is a block diagram of a perforating Switch Unit.

FIG. 14B is a block diagram of an alternative embodiment of aperforating Switch Unit.

FIG. 15 is a block diagram showing a Switch Unit integrated into adetonator.

FIGS. 16A and 16B are flow charts showing a program control sequence.

FIG. 17 is a state diagram for a state machine within a Switch Unit.

FIGS. 18A and 18B are flow charts describing a program control andsequence.

FIG. 19A is a diagram of a generalized perforating tool string.

FIG. 19B shows a tool string including multiple auxiliary tractors andlogging tools.

FIG. 19C shows a tool string with positive and negative logging tools.

FIG. 20 is a flow chart describing a program control sequence forcommunicating with devices that are connected in a tool string inparallel and in series.

FIG. 21 is a state diagram defining a predetermined logical flow forselecting various devices that are connected in a tool string inparallel and in series.

DETAILED DESCRIPTION OF EXAMPLES OF THE INVENTION

Referring now to the figures, FIG. 1 is a diagram of a tool stringincluding a perforating gun string, downhole Sensors and Release Device,Safety Sub for preventing unwanted voltages from getting to the gunstring, Casing Collar Locator (CCL) or other positioning device forlocating the gun string within a cased well bore, Tractor Unit forpushing tools along a horizontal well bore, and wireline unit containinga wireline wench, Surface Controller, computers and power supplies. Awireline collector provides a method for selecting either the SurfaceController or the Tractor Power Unit.

FIG. 2 is a block diagram of a Surface Controller that integratesperforating, tractor operations, logging and other well services,including pre-checks for tools at the surface. This pre-check wouldinclude, but is not limited to, Tractor and Safety Sub operations,select fire switches, sensors, release devices and communication linksassociated with logging and perforating operations and tractoring. TheSurface Controller also supports receiving and transmitting signals to aTractor, Safety Sub, Release Device, Sensors and Switch Unit.Controlling power supplies, archiving job data, program control, andsafety barriers are also functions of the Surface Controller.

FIG. 3 shows tool strings being prepared for downhole service. In FIG.3A, a Surface Controller interfaces to a Tractor for providing power andcommunications. Typical pre-checks and set-ups for the Tractor includesetting all switches to an initial condition for safe operation andchecking communication functions. Communications and functions are alsochecked for the Sensors, Release Devices and select switches within theperforating gun. FIG. 3B shows a Surface Controller for checking Tractorfunctions only. FIG. 3C shows a surface check of only the ReleaseDevice, Sensors and select switches. Any combination of tools can betested at the surface. A laptop computer provides control to the SurfaceController through a wireless connection.

FIG. 4 shows a Pre-check Controller used in the pre-check shown in FIG.3.

FIG. 5 is a flow chart describing program control for performing apre-check on the gun string containing selective Switch Units prior torunning downhole.

FIG. 6 is a block diagram of the Tractor Controller electronics forsending and receiving commands and controlling switches for tractoroperation or perforating events.

FIG. 7 shows the combination of position for two sets of form Cswitches. No single switch can be positioned such that the tractor wouldbe unsafe for perforating.

FIG. 8 is a block diagram of various sensors within the tractorelectronics.

FIGS. 9A, 9B, and 9C are block diagrams of different embodiments of thecircuitry, including a voltage blocker, of a Safety Sub that resides ontop of a perforating gun string. FIGS. 9D-1 and 9D-2 are block diagramsof a Safety Sub incorporating a voltage blocker of the type shown inFIG. 9C.

FIG. 10 is a flow chart for a Tractor Controller single State Machinefor controlling either tractor electronics, shown in FIG. 6, or SafetySub, shown in FIG. 9.

FIG. 11 is a State Diagram for a single State Machine which can controleither the electronics of the Tractor, shown in FIG. 6, or the SafetySub, shown in FIG. 9.

FIG. 12 is a block diagram for a Power Line Carrier Communication (PLCC)interface to the wireline. The interface could be the same at thesurface and at the tractor.

FIG. 13 shows a tool string that includes Switch Units in a gun stringfor firing selected guns, a wireline, a logging truck equipped with apower supply and a surface computer for controlling job events such ascommunication with the Switch Units, data storage, power suppliescurrent and voltages, all following standard safety procedures.

FIG. 14A is a block diagram of a perforating Switch Unit according to anembodiment shown in FIG. 13. The Switch Unit shown is adapted for apositive voltage on the wireline conductor with the wireline armor beingat ground potential.

FIG. 14B is a block diagram of an alternative embodiment of theperforating Switch Unit that utilizes two-level uplink communicationsand an internal status check of the detonator switch that is configuredfor perforating with negative voltage.

FIG. 15 is a block diagram showing a Switch Unit integrated into adetonator.

FIGS. 16A and 16B are flow charts describing the program controlsequence for initializing a three-gun string and firing the bottom gun.

FIG. 17 is a state diagram for the state machine within a Switch Unitdefining the predetermined logical flow for selectively firingdetonators in a gun string.

FIG. 18 is a flow chart describing the program control and sequence forinitializing a two gun string and firing the bottom gun using commondownlink commands for all Switch Units that solicit a unique addressfrom each Switch Unit.

FIG. 19A is a diagram of a generalized perforating tool string includinga setting tool and auxiliary devices such as sensors and cable releasemechanisms illustrating both series and parallel communication paths.FIG. 19B shows a tool string including multiple auxiliary tractor andlogging tools. The auxiliary and logging tools shown in

FIG. 19B are powered by positive DC voltage from the surface as shown inFIG. 19C.

FIG. 20 is a flow chart describing the program control sequence forcommunicating with devices that are connected in a tool string inparallel and in series.

FIG. 21 is a state diagram defining the predetermined logical flow forselecting various devices that are connected in a tool string inparallel and in series.

In more detail, and referring to FIG. 1, a tractor system is shownequipped with a tractor 10 for pushing perforating gun 18 alonghorizontal or nearly horizontal sections of an oil well, casing collarlocator (CCL) 12 (or any correlation device for depth association),Safety Sub 14 for preventing tractor voltages from migrating to the gunsystem, and set of sensors for monitoring downhole events/Release Device18 for separating the gun string from tractor 10 and perforating gun 18.Logging truck 20 typically houses power supplies and computers forperforming required logging and perforating operations. A separate powersupply 22 is typically used for supplying tractor power through awireline 24 using high voltage in the range of 1000 Volts AC or DC.

Perforating power supply 26 and Tractor Power Unit 22 are not connectedto the Wireline Collector 28 at the same time. Wireline Collector 28provides a means for selecting a plurality of different signals or powerfor a specific operation. In all cases, only one signal and/or powersource 22, 26 is connected to wireline collector 28 at a time.

The supporting peripherals used during a tractor and perforatinginterval are shown in FIG. 2. The Surface Controller 30 interfaces withall power supplies, commands ON/OFF sequences, and controls and deliversvoltage and current to the tool string. In addition, surface computer 32runs software for controlling and recording all communication eventsduring a perforating job, such as position of the Switch Unit within thegun string. Computer 32 is also provided with a monitor (not shown) fordisplaying a visual tool string and events during a job. On many wells,the tractor operator does not have the capability of running additionalservices because of equipment differences or for lack of integratedsupport hardware. The embodiment shown illustrates a Surface Computer 32and peripherals for supporting both perforating and tractor operation,which provides more reliable and safer operation. The more commonarrangement has separate responsibility for controlling tractor andperforating operations.

Surface Controller 30 runs such events as pre-check and initializationof tractor 10, controlling tractor power supply 22 during tractoroperation, running embedded software for logging during tractoroperations, controlling sequences during a perforating job,communicating with and controlling other tools in a string such asdrop-off joints (to disconnect in case of being stuck in the hole),safety sub functions, and operating parameters of tractor 10 such astemperature, RPM, voltage and/or current, etc. A Downlink Driver 34typically interfaces to wireline 24 through transformer 36 to sendsignals down wireline 24 while powering the tools below. Uplink signalsare monitored across a Signal Transformer/current-viewing-resistor (CVR)38 and decoded for message integrity by uplink 40. Series wirelineswitch 42 turns power ON or OFF under computer control and also by meansof using a manual removable safety key 44.

Surface Computer 32 is also equipped with a wireless or cable, orcombination of wireless and cable, interface 46 to Pre-Check Controller48. Pre-Check Controller could include a laptop, PDA or anypreprogrammed device that controls predetermined events, a laptopcomputer being shown in FIG. 2. Pre-Check Controller 48 is connected tothe tractor or gun string as shown in FIG. 3 while at the surface forpre-check procedures during which wireline safety switch/key 44 is inthe OFF position with the key removed. Also due to a low power RFrestriction during perforating, it may be necessary to have the 25Surface Computer 32 equipped with an extension cable having areceiver/transmitter attached to one end to allow the wireless path tobe a shorter distance and in line of sight.

As described above, Surface Controller 30 is equipped with powersupplies 22, 26, one for perforating and another for tractor operations,in separate compartments for safety reasons, and only one is connectedto wireline 24 at a time through a Perf/Tractor switch in wirelinecollector 28. The switch could also be a physical connector that allowsonly one connector to be installed at a time. Those skilled in the artwill also recognize that computer 32 can be configured to sensewhichever power supply is connected and only allow the programs to runthat are associated with a particular power supply.

FIG. 3 shows various tool string configurations being tested at thesurface before running in the hole. The support equipment for setup andtest operations is Pre-Check Controller 48 that connects to the wirelineinput of the tool string, provides power and communications to thetractor input, and receives program control from a laptop through awireless or cable connection, or from a Surface Controller as shown inFIG. 2. Radio frequency power must remain low in a perforatingenvironment and therefore communication links are not limited to asingle RF link. The communication link could lobe implemented using RFrepeaters to get around steel buildings and remain in the line of sight,use RF receiver/transmitters on an extension cable, or a simple cableconnection.

FIG. 3A shows typical pre-check functions for a system comprised ofTractor 10, CCL 12, Safety Sub 14, Release Sub/Sensor Unit 16, andperforating gun 18 including selective Control Units (described below).The tests performed for Tractor 10 and Safety Sub 14 include, but arenot limited to, verifying communications, setting up switches to safepositions to perform tractor operations, soliciting status from theTractor and Safety Sub switches, and functions such as verifying sensordata transmissions. Tests for the Sensors and Release Device 16 includecommunications and function tests. Tests for gun 18 include sendingwireline ON commands to the Control Units, verifying communication toall Control Units, and correlating Control Units to specific guns andare normally performed without perforating gun 18 attached, but with thePre-Check Controller 48 described herein, it is possible to leaveperforating gun 18 attached because, in one embodiment, SurfaceController 30 limits current output in compliance with theabove-described API RP67. FIG. 3B shows a pre-check for a tool stringincluding only Tractor 10 and Safety Sub 14 equipped with other type ofselect fire devices that would not be tested by Pre-Check Controller 48.FIG. 3C shows a pre-check for a Release Device/Sensor Sub 16 andperforating gun string equipped with selective Control Units (FIG. 3A).The Surface Controller 30 or laptop also stores pre-check and setup datafor conformation of proper operation. Using a Surface Controller locatedin logging truck 20 instead of a laptop, all functions, includingpre-check, tractor operation, depth correlation, and perforating, areperformed inside the wireline unit, reducing operational rig time.

The purpose of the pre-check is to verify proper function of all controlunits connected to the wireline. Tractor Control Units, Safety SubControl Units, and Sensors and Release Devices are tested. An additionalreduced current and voltage power supply is utilized for testing SwitchUnits within a gun string to verify that the Control Units arecommunicating and functioning correctly before running the perforatinggun in the hole, and for safety reasons, are typically not done with thesame power supply used to fire the gun downhole. As described above, thespecial power supply generates communication power signals with limitedcurrent output in accordance with API RP 67. Pre-Check Controller 48commands a special internal power supply and sends power along withsignals to the Control Units in the gun string through a connectingcable. Pre-Check Controller 48 receives wireless commands from a laptop;alternatively, Surface Controller 30 communicates wirelessly usingcommunication protocols such as BlueTooth, which limits wireless outputpower according to established commercial standards.

FIG. 4 illustrates the Pre-Check Controller 48 and functional blocksrequired for conducting a tractor pre-check. Pre-Check Controller 48 isa self-contained, battery operated device that communicates on one sidethrough wireless or cable link to a laptop or Surface Controller 30(FIG. 2) and connects directly on the other side to the tractor input. AState Machine, implemented within a microprocessor, controls eventsbased on commands received and is recommended for most solutions inwhich non-time-critical tasks are performed. In addition, themicroprocessor is provided with functions such as signal conditioning,analog-to-digital inputs, digital inputs, driver outputs, watch dogtimers, etc., as known in the art. As described herein, a state machineis as an algorithm that can be in one of a small number of states (astate is a condition that causes a prescribed relationship of inputs tooutputs and of inputs to next states). Those skilled in the art willrecognize that the state machine described herein is a Mealy machine inwhich outputs are a function of both present state and input (as opposedto a Moore machine in which outputs are a function only of state). Thestate machine as defined can also be implemented using an ApplicationSpecific Integrated Circuit (ASIC), programmable logic array (PLA), orany other logical elements conforming to a predefined algorithm.

A Downlink Driver 50 provides an interface link between theMicroprocessor and Signal Transformer 52 that is capacitor coupled tothe wireline. Induced signals from transformer 52 are received by theTractor or Safety Sub (not shown in FIG. 4). An Uplink Detector 54provides signal interfaces between the Microprocessor and a CurrentViewing Resistor (CVR) 56 or Signal Transformer 52. The components ofUplink Detector sense and condition signals received from either theTractor Unit or Safety Sub. Power for the surface controller is derivedfrom on-board batteries 58 that can be turned ON and OFF 60. Powersupplies 62 convert the battery power for proper operation ofelectronics and tractor communication. A current limiting element 64 inseries with the power output limits the current level in compliance withAPI RP 67. A series wireline switch provides a means for turning thepower ON or OFF under computer control.

As an example, the following describes a pre-check event for a pluralityof Switch Units. FIG. 5 is a flow chart describing a first embodiment ofthe program control for performing the pre-check. Unlike the secondembodiment described below, in this embodiment, no unique addressees)is/are used in the uplink communications. The position of each SwitchUnit in the perforating string is determined by recognition of thestatus of the respective State Machine and the proper sequencing ofmessages.

The default or initial condition of the Deto Switch (see FIG. 14B) isthe OFF position, thereby disallowing power to all detonators. Thedefault condition for each W/L switch is also in the OFF position sothat there is no wireline connection beyond the input of the top SwitchUnit. Pre-Check Controller 48 commands a power supply to apply a powersignal to the gun string through a connecting cable, energizing theState Machine in the top Switch Unit. Pre-Check Controller 48interrogates the top Switch Unit and sends a State (0) command (see FIG.17 for a state machine diagram). After receiving the first message, thetop Switch Unit validates the message. Upon receiving a valid message,the State Machine in the top Switch Unit advances and uplinks a messagecontaining switch status, state machine status, and a security checkword. Upon receiving an invalid message, the Switch Unit uplinks aninvalid message response. Upon receiving the first uplink message, thesurface computer validates the message, verifies the state machinestatus, and downlinks a W/L ON command. If the Switch Unit sent an errormessage or the uplink message was invalid, power to the gun string isremoved and the process restarted. After receiving the second downlinkmessage, the top Switch Unit validates the message, and if valid, theSwitch Unit advances the State Machine of the top Switch Unit, turns theW/L Switch ON, and uplinks a message containing switch status, statemachine status and a security check word. The top Switch Unit then goesinto hibernation. This process is repeated for each and every SwitchUnit in the string. By recognizing the change in state of each SwitchUnit as it communicates, the surface computer uniquely identifies eachSwitch Unit in the string.

One variation on this sequence is for the top Switch Unit to send anuplink message upon power up containing a State (0) status, StateMachine status, and security check word. The surface computer recordsand validates the message and returns a command advancing the StateMachine to (1), turning W/L Switch ON. The top Switch Unit then sends asecond uplink message containing a State (1) status. Applying power tothe next Switch Unit wakes it up and triggers an uplink message of itsState (0) status. The uplink is delayed to allow the second uplinkmessage to be received first at the surface. The second Switch Unit isthen commanded from the surface to advance to State (1), and so forth.By recognizing the change in state of each Switch Unit as itcommunicates, the surface computer uniquely identifies each Switch Unitin the string.

A tractor has two basic operation modes, Tractor Mode or Logging Mode.In Tractor Mode, high power is delivered to the motor for pushing toolsalong a section of a well. In Logging Mode, the tractor provides only athrough-wire connection to tools connected below the tractor. FIG. 6illustrates a control function for directing wireline voltages to eitherthe tractor motor/Tractor Mode, or directing the wireline to the tractoroutput/Logging Mode. After the tractor has pushed the tool string intolocation, redirection to Logging Mode is required. The wireline mustfirst be disconnected from the tractor motor and then reconnected to thetractor output.

The following disclosure describes a control system within the tractorthat safely disconnects the wireline from the tractor motor and connectsit to the output of the tractor. The system only allows connection tothe Logging Mode when certain criteria are met and verified, and isredundant so that a single point failure cannot cause unwanted voltagebelow the tractor. Referring to FIG. 6, the system comprises two similarcircuits 66 connected in series. First circuit 66A controls a set ofswitches 68A connecting the wireline to either the tractor motor orswitches 68B in second circuit 66B. Second circuit 66B controls a set ofswitches 68B connecting the output of the tractor either to ground orswitches 68A. Each set of single-pole, double-throw (SPDT/form C)switches is ganged together with another like pair of contacts in orderto obtain status of the combined pair. The switches 68A, 68B shown inFIG. 6 are generic and can be one or more different types such aslatching relays, latching solenoid piston switches, bi-directional solidstate switches in the form of N and P channel Field Effect Transistors(PET), insulated gate bipolar transistor (IGBT) with high side drivers,etc. The Switch Control 70A, 70B between respective microprocessors 72A,72B and switches 68A, 68B is designed for the appropriate action asknown to those skilled in the art. Switches 68A, 68B are controlled fromthe surface by sending signals to the control units that are decoded byonboard microprocessor 72A, 72B, processed by the respective statemachine, and used to control switch position. In addition, switch statusis returned to the surface, validating switch action. Each control unitis also provided with an onboard power supply 74A, 74B and transmit 76A,76B and receive 78A, 78B circuits for communication.

For safe perforating while using a tractor, it is necessary to avoidsingle point allures that cause unwanted voltages on the tractor output.FIG. 6 shows the combinations of positions for the Motor switch and Logswitch. Each switch has two positions, yielding a total of fourcombinations, shown in FIGS. 7A, B, C, and D. In all cases, wirelinevoltage must pass through two separate switches controlled by separatecircuits before reaching the output, satisfying the single point failurerequirement.

It is sometimes important to solicit operating parameters associatedwith tractor operations including, but are not limited to, temperature,head voltage and current delivered to the tractor unit, and tractormotor RPM. Operating parameters are retrieved in real time by surfacecomputer 32 using power line carrier communications (PLCC) that providefor both downlink and uplink communication signals to be sent over awireline while the tractor is powered. On the transmit side, signals areinjected onto the wireline and ride on top the power. On the receiverside, signals are extracted using band pass filter techniques, allowingcommands to be sent to the tractor control electronics as well asretrieving status from downhole events. FIG. 8 depicts a separatemicrocontroller using the same protocol as in FIGS. 6 and 9. Inputvoltage 80 into tractor motor 82 is sensed 30 using a resistor voltagedivider for DC tractors or a step-down transformer followed by a bridgerectifier for an AC tractor. These status signals are conditioned,scaled, and sent to an analog-to-digital input of microprocessor 84.Monitoring current delivered to a tractor motor can reveal whether amotor has lost traction, is in a lock rotor condition, or is being over-or under-loaded relative to well bore temperature. Tractor current ismonitored by sensing voltage across a current-viewing-resistor (CVR) 86using an operational amplifier 88 having sufficient gain for reading byan analog-to-digital input. The scale factors used depend on loadranges, analog to digital bits, and required accuracy.

A plurality of temperature sensors, shown schematically at referencenumeral 90, are used to monitor downhole temperature, motor windingtemperature, boring bit temperature, or any other tractor functions asknown in the art. A variety of sensors may be used, including aresistor-thermal-device (RTD) associated with a reference voltage,thermocouples, junction voltages of semiconductors, andvoltage-to-frequency converter associated with an RTD. In all cases, acalibration and scale factor is part of an overall design as known topersons practicing the art. Sensor outputs are represented by either avoltage or frequency and monitored by either analog-to-digital input ortime domain counter and converted to temperature. Therevolutions-per-minute (RPM) of various motors within a tractor isimportant for milling operations as well as pushing payloads. The RPMsensor 91 accumulates pulses generated by motor shaft rotation andcounted over a selected time for RPM derivation. Other sensors may beused including, but not limited to, magnetic field coupling, optical,infrared, switch contacts, and brush encoders.

For safe perforating with a tractor system Safety Sub 14 (FIG. 1) isplaced between the output from tractor 10 and the input to perforatinggun 18. Safety Sub 14 must not have any single point failures and istypically certified by an outside authority. Safety Sub 14 has two modesof operation, Safe Mode (during tractor operations) and PerfMode (onlywhen perforating). Switching between modes is done only after tractorpower has been disconnected at the surface.

FIG. 9A illustrates a system with no single point failures, accomplishedwith two circuits 92A, 92B connected in series for redundancy. When thefirst (bottom) circuit 92A is in Safe Mode, switch K1 disconnects fromthe wireline and connects the entire second (top) circuit to ground. TheSafety Sub output is also grounded either through switch K1 or switchK2. If the first (bottom) circuit 92A is in Perf Mode, switch K1connects the second (top) circuit 92B to the wireline. The output isagain protected by the second switch K2. For wireline voltages to passto the Safe Sub output, two sets of switches, K1 and K2, must becommanded and set to Perf Mode. The second circuit 92B provides controlto a set of switches K2. Switch K2 connects the output of Safety Sub 14to either ground or the center contact of switch K1. Whenever switch K2is connected to ground, Safety Sub 14 also provides a ground to theperforating gun input. Whenever switch K2 is connected to the centercontact of switch K1, the Safety Sub output may be connected to groundor the wireline input. The logic that follows shows that both controlcircuits must fail in PerfMode before Safety Sub 14 can pass unwantedvoltage.

Each set 94A, 94B of single-pole-double-throw (SPDT/form C) switches areganged together with another like pair of contacts to obtain true statusof the existing pair. The switches shown are generic and can be one ormore of many different types such as latching relays, latching solenoidpiston switches, bi-directional solid state switches in the form of Nand P channel FETs, and IGBT with high side drivers, all as known in theart. The switch control 96A, 96B between microprocessor 98A, 98B and theswitch element is designed for appropriate action as known in the art.Switches within Safety Sub 14 are controlled from the surface by sendingsignals to the Control Units that are decoded by onboard microprocessor98A, 98B and used to control the position of switches 94A, 94B. Inaddition, switch status is returned to the surface, thereby validatingswitching action. Each control unit also has an onboard power supply100A, 100B along with circuits that transmit 102A, 102B and receive104A, 104B communication signals.

The motorized piston switch shown in FIG. 9B has the advantage of aconstruction that is easily adapted to round tubing geometry andprovides a rugged and reliable switch for the high shock perforatingenvironment. In addition, the position of the contact makeup, eitheropen or closed, remains in position after removal of all power. Thelatching feature of the piston switch allows the tractor operator to setthe switch to a desired position and then turn wireline operations overto a contractor for logging or perforating services. The piston switchis comprised of the following functions. A microcontroller 106 controlsthe signal for turning motor 108 ON and OFF and selects the direction ofthe motor rotation (clockwise- or counter-clockwise). Additionally,microcontroller 106 monitors the position of the Piston Switch todetermine if the contacts are in either the SAFE or PERF position. AnH-Bridge 110 receives commands from microcontroller 106 and changespolarity to DC motor 108, thereby allowing the motor to turn in eitherdirection. Motor 108 is connected to a planetary gear reduction boxequipped with a threaded screw section. The threaded screw section,having an embedded set of contacts, shuttles back and forth to make upto mating contacts. This action forms either a single pole single throw(Wireline to Gun contact) or single pole double throw (as Perf and SafeStatus to the micro). The switch shown on top of FIG. 9B is in an openposition (SAFE) and the switch on the bottom is in a closed position(PERF).

A wireline can short to ground when the perforating gun fires andcommunication can be interrupted, particularly with a form-C switch.Without communication, the switches in both Tractor 10 and Safety Sub 14cannot be changed. FIG. 9A shows two methods for resolving a shortedwireline situation. The first is to place the primary of a transformer112 in series with the output of Safety Sub 14. The output side oftransformer 112 is also shunted to ground through a small capacitor. Thevalue of the capacitor is chosen such that it only provides a shunt toground at frequencies much higher than communication frequencies andtherefore does not interfere with normal communications and perforatingoperations. A W/L Disconnect Control 114 is connected to the secondaryof transformer 112. W/L Disconnect Control 114 encompasses a bridgerectifier and is filtered in order to produce DC voltage and a path toroute the developed voltage to release the switch from the Safety Suboutput. When a shorted wireline exists on the output of Safety Sub 14, ahigh frequency signal is sent from the surface through the transformerand capacitor. The result is that a voltage is developed on thesecondary of transformer to actuate the Safety Sub switch K2 and clearthe short. A second method (not shown) of preventing a short on theoutput of Safety Sub 14 is to place a diode in series with the output ofthe Safety Sub. Those skilled in the art will recognize that the diodecould be a normal diode of chosen polarity, a single Zener diode ofchosen polarity, or a back-to-back Zener having a predeterminedbreakdown voltage in both directions. Using a normal diode as anexample, perforating is done in one polarity and communication in theopposite polarity. With a simple diode, only one polarity is shorted toground, thereby allowing communication using the opposite polarity.

Alternatively, a Zener provides the same results as a normal diode alongwith a selected breakdown voltage in one polarity. With a properlyselected Zener voltage, communication continues at signal levels belowbreakdown voltage with the advantage that shooting of perforating gun 18can be done selectively in both polarities. The voltage delivered to gun18 in one polarity is less by the Zener breakdown value and generallyhas no effect on perforating. A back-to-back Zener has all the featuresof a single Zener diode except that standoff voltage is the same forboth polarities. The voltage delivered to gun 18 is less by the Zenerbreakdown value for both polarities of shooting voltage. Again, nodetrimental effect is seen during selective perforating. Voltage blocksbetween Safety Sub 14 and gun 18 are also accomplished using a Triac(not shown) that triggers at a predetermined voltage above the operatingvoltages of Safety Sub 14 that is either positive or negative. The Triacblocks all voltages until triggered, and after being triggered, only asmall voltage drop is seen across the device, which is desirable forShooting selectively (plus and minus polarities).

Another method for creating a voltage block between Safety Sub 14 andgun 18 is implemented with a set of FET transistors. One P-Channel FETcontrols or switches the high side and the other N-Channel FET controlsor switches the low side, allowing both polarities to pass for selectiveshooting. Again, predetermined switch voltages (turn ON) can beimplemented using zeners, diacs, thyristors, etc.

FIG. 9C shows a negative voltage blocker between the top of perforatinggun 18 and Tractor 10 that prevents negative wireline voltages frombeing seen by the Detonator when communicating to tools in the stringabove the perforating gun, provides a negative disconnect between thetop of a shorted gun and other communication units, provides a shuntacross the Detonator for negative wireline voltages to reduce currentacross the Deto due to Triac leakages at elevated temperature, andallows unrestricted positive voltages to pass (except for the twopositive shoot diodes) described below. Like the method for resolving ashorted wireline and/or losing communication with the guns in the stringshown in FIG. 9B, the negative voltage blocker shown in FIG. 9C iscomprised of first and second circuits 134A, 134B providing redundancyin the event of parts failures, each circuit 134A, 134B including arespective Triac switch 136A, 136B in series such that both must failshorted to render the voltage blocker inoperative. Each circuit 134A,134B includes a diode protector 138A, 138B that prevents positivewireline voltages from damaging the parts of the circuits that aresensitive to polarity and a voltage standoff/Zener 140A, 140B thatprevents the respective Triac switches 136A, 136B from turning ON or theShunt in each circuit 134A, 134B from turning OFF before the Zenerconducts. The Triac triggers 142A, 142B in each of circuits 134A, 134Bturn ON after reaching the stand-off voltage and provide a current pathfrom the gate of the respective Triac switches 136A, 136B to ground andforce the Triacs 136A, 136B to turn ON, providing high power, highvoltage switches for controlling the negative wireline voltage to Deto.Disconnect controls 144A, 144B turn ON after reaching the stand-offvoltage and provide a ground path for turning the respective loaddisconnects 146A, 146B within the load controls OFF. Load disconnects146A, 146B are normally ON to switch the shunt to OFF after reaching thepre-determined stand-off voltage. Deto shunts 148A, 148B provideparallel current paths across the Deto until negative wireline voltagereaches the pre-determined stand-off voltage. The shunts from each ofcircuits 134A, 134B are connected across the Deto in parallel. Diodes150A, 150B in each circuit 134A, 134B provide a path from the wirelineto Deto, allowing unrestricted positive voltages to pass for shootingwith positive voltages.

One embodiment of a safety sub constructed in accordance with thepresent invention is shown as a block diagram in FIG. 9D-1. Theabove-described control unit is incorporated into the safety sub shownin FIG. 9D-1 on the left side of the figure.

FIG. 10 illustrates a method for communicating with amicroprocessor/state machine without sending a downlink address for anidentifier. Typically an identifying address is embedded in the hostmessage when two or more remote devices are on a common buss to preventcoincident response signals from multiple remote responding devices. Inaccordance with the present invention, each state machine/remote devicehas a plurality of its own set of legal commands. Upon receiving amessage, the controller decodes the embedded command. Only if thecommand is legal is the receiving controller allowed to generate anuplink message, thereby preventing buss contention or collision of datawhen two or more remote units are on a buss or party line connection. Inaddition, before uplink transmission can occur, the logical position ofthe state machine is compared and must be in sync with the expectedstate position transmitted by the host. This comparison furtherdiscriminates which messages are legal and which controllers are allowedto return an uplink message. In another embodiment, a unique identifieris attached to each uplink or returned message to further distinguish oridentify one control unit from another. In another embodiment, uniqueidentifiers are attached to both uplink and downlink messages. Thesemethods apply to each controller within the Tractor Electronics (FIG. 6)and to each control unit within the Safety Sub (FIGS. 9A and 9B).

Referring to FIG. 10, the Surface Unit first applies power to thewireline, causing all control units on the communication buss toinitiate a power-up reset and enter state “0” waiting for a downlinkmessage. The Surface Unit then sends a downlink message containing aplurality of commands specific to only one controller along with a state“0” status. Every downhole controller receives and verifies the messagefor errors. If an error is detected, the downhole controller reverts tostate “0” with no further action. If the message is error free, thestate machine advances and the command bits within the message aredecoded. If the command is illegal, the downhole device reverts to state“0.” If the command is legal for a particular device, the state machineagain advances, uplinks a message, and waits for a second response. TheSurface Unit receives and validates the first uplink message, and if inerror, the surface controller goes into a restart mode by turning powerOFF and then back ON. If the message is error free, the SurfaceController transmits a second message containing the same controlcommand and the state machine expected position. Again, all remotecontrol units receive the second message but only the one controllermatching the downlink state position that receives a legal command isallowed to advance and process the message. If the message is verifiedand an error exists, a bad message status is returned and the downholedevice must be powered down to continue. If the message is verified freeof errors, the command is processed and a return (uplink) confirmationmessage is transmitted. The Surface Unit receives and validates themessage. If the message contains errors, the Surface Controller restartsthe entire process. If the message is error free, the Surface Controlleraccepts the data and continues to the next downhole controller.

FIG. 11 illustrates a predefined sequence of events for controlling eachdownhole device (such as the Tractor Control Unit or a Safety Sub)containing one or more microprocessors or state machines. Upon power-up,the state machine enters state “0” and waits for a downlink message.Upon receiving a message from the surface, the state machine advances tostate “1.” While in state “1,” the message is validated for proper stateposition, cyclic-redundancy-check, and message length. An invalidmessage causes the state machine to revert to state “0.” If a validmessage is decoded, the state machine advances to state “2” and thecommand bits are decoded. If an illegal command is decoded for thatparticular controller, the state machine again reverts to state “0.” Ifa legal command is decoded, the device returns a message containingstate “3,” the decoded command, switch status, embedded address (ifused) and cyclic-redundancy-check, and device waits for a seconddownlink message. Upon receiving a second downlink message, the statemachine advances to state “4.” While in state “4,” the downholecontroller verifies receiving the proper state position from the surfacecontroller, again compares the command bits with the previous commandbits, cyclic-redundancy-check, and message length. If the message isinvalid in any way, the state machine advances to state “6” and thedownhole controller transmits an uplink message confirming an invalidmessage. At this point, the controller must be powered down in order torestart. If the message is valid, the state machine advances to state“5” and processes the command. For the last event, the downholecontroller transmits an uplink message including state “5” position,switch status, embedded address (if used), and cyclic-redundancy-check.The microprocessor/state machine now enters a sleep mode whilemaintaining its present logic state and will not listen to any moremessages until a complete restart.

The block diagram in FIG. 12 is but one example for interfacing a PowerLine Carrier Communication (PLCC) scheme onto a wireline and could bethe same at the Surface Controller in FIG. 2 and the Tractor ControllerFIG. 6. For those skilled in the art, there are many ways to interface apower cable for PLCC operations. A capacitive coupled transformer tapsacross the wireline (power line), providing a route for injecting highfrequency communication signals onto the wireline and for extractingsignals from the wireline during power operations. The receiver sectionalso includes a Receiver Filter and Amplifier for conditioning thesignal for use by the microprocessor. The transmitter section alsoincludes an amplifier of sufficient power for signal generation.Communicate using half-duplex, master/slave party line, and complies tointerrogation/response only (no unsolicited uplinks). Signals:

a. Downlink—FSK (mark/space frequencies TBD)

b. Uplink—Current Loop, modified NRZ or Manchester Baud Rate—300 Baud orhigher (for example).

FIG. 13 shows a perforating gun system with three guns attached towireline 24 (or to any electrical conductor) that is conveyed into awellbore to a first formation zone to be perforated using a truck 20 andwinch. A Surface Controller and associated power supply is typicallylocated in a logging truck. The firing sequence begins on the bottom(Gun 1) and progresses upwardly to the top gun (Gun 3), completing thefiring sequence. The system is initialized starting with Gun 3, followedby Gun 2 and Gun 1.

Initialization of the Switch Units (FIG. 14A) occurs by sending powerand a sequence of signals to the gun string. In one embodiment, thefirst command signal is sent to the top gun, thereby validating itspresence and position followed by turning its wireline (W/L) Switch toON. The second gun (middle) is initialized in the same manner.Successive messages are sent to the first gun (bottom) and validatedbefore turning on the ARM Switch and Fire Switch, respectively. Wireline24 is prevented from shorting to ground because the W/L Switch of SwitchUnit (1) remains OFF during firing. Shooting voltage is then applied tothe wireline and the bottom gun is fired, destroying Switch Unit (1).The remaining Switch Units disconnect automatically from wireline 24when power is turned off. Following relocation to a second perforatingzone, the initialization sequence is repeated, except only two gunsremain in the string. The bottom gun is now Gun 2. The signal is sent tothe top gun, thereby validating its presence and position, followed byturning its W/L Switch to ON. Successive messages are sent to the secondgun (bottom) and validated before turning on the ARM Switch and FireSwitch, respectively. Shooting voltage is then applied to wireline 24and Gun 2 is fired. Following relocation to the third perforating zone,the initialization sequence is repeated except only one gun remains inthe string. The bottom gun is now Gun 3. Successive messages are sent tothe third gun (bottom) and validated before turning on the ARM Switchand Fire Switch, respectively. Shooting voltage is then applied to thewireline and the bottom Gun 3 is fired, completing the shooting sequencefor a three-gun string. If the gun string has more or fewer guns, thesame sequence of initializing and shooting follows the example presentedhere. If one of the guns fails to fire, the operator can communicate andcontrol the remaining guns. Given that misfires are frequent, an extragun(s) can be attached to the gun string and fired in place of amisfired gun, saving an additional trip in the hole. Accidentalapplication of voltage on wireline 24 will not cause detonation becauseproper communication must be established before the Switch Unit willconnect to the detonator. As an added safety element, a top switch maybe added that is not connected to a detonator, giving a safetyredundancy that prevents accidental detonation should a Switch Unit bedefective.

FIG. 14A is a block diagram of a perforating Switch Unit showing thewireline input voltage to be positive with the wireline armor at groundpotential. Power Supply 116 input connects the Switch Unit to thewireline and regulates the voltage for the power circuitry within theSwitch Unit. State Machine 118 receives downlink messages, providesuplink states, traces command-sequence status and controls the W/L andDeto Switches 120, 122, and can be a specially programmed microprocessoror separate circuitry that is functionally equivalent to amicroprocessor. Receiver 124 interfaces to the wireline to capture datafrom downlink signals. The Xmit transmitter 126 induces a signal currentonto the wireline that is decoded at the surface. A Deto Switch 122,controlled by State Machine/microprocessor 118, provides switchingbetween wireline power and detonator, and may be a single switch or twoswitches in series (for additional safety). During a perforatingsequence, only the Deto Switch 122 in the bottom gun is selectivelyturned ON to apply power to the detonator. The W/L switch 120 controlsboth firing power and communication signals through the gun string. Inone embodiment, W/L and Deto switches 120, 122 include transistors suchas field effect transistors (FET) or integrated gate bipolar transistors(IGBT), but those skilled in the art who have the benefit of thisdisclosure will recognize that any type of switch that allows power tobe connected by command to provide the advantage of disconnecting whenpowered down, thereby preventing the wireline from seeing a short duringthe next command sequence, may be utilized. As shown in FIG. 14A, a HighSide Driver 128 is used to interface State Machine 118 to W/L Switch120. Shooting power is shown as positive, which requires a High SideDriver to interface State Machine 118 to W/L Switch 120. If shootingpower is negative, a High Side Driver would not be necessary providedthe W/L Switch is in series with the W/L Armor input and the W/L In ispowered with negative voltage.

A second embodiment of the perforating switch shown in FIG. 14A is shownin FIG. 14B, in which the signals transmitted from the Switch Units arepermitted to have two different levels of uplink: current. The currentlevel for uplink: Manchester communication is commanded from the surfacecomputer to be either high 170 or low 172, depending upon whether theSurface Controller 30 (not shown in FIG. 14B) or the pre-checkcontroller 48 (not shown in FIG. 14B) is commanding the Switch Units.This feature limits the communication current to a low value below thatspecified by API RP 67 whenever a communication check is done at thesurface using an API RP 67 compatible Surface Tester with the SwitchUnits attached to detonators (see FIG. 3). In one embodiment, thecurrent level of the first (low) transmitter is in the range of fromabout 4 milliamps to about 15 milliamps and the current level of thesecond (high) transmitter is in the range of from about 10 milliamps toabout 100 milliamps and those skilled in the art will recognize that thecurrent level of the first and second transmitters depends upon factorssuch as the number of Switch Units in the string. The limitation oncurrent is not necessary, however, when the guns are deployed downholeon the cable (FIG. 13), which allows for higher current levels andconsequently higher signal-to-noise. This feature of being able toselect a higher uplink: current level allows for more robustcommunication over long cables, for example. Although described hereinwith reference to a perforating gun, those skilled in the art willrecognize that the Switch Unit may be a Switch Unit for a release deviceor an explosive device for lowering into a wellbore as well as aperforating gun.

FIG. 14B shows another feature that improves reliability and safety ofthe Switch Units should the switch that connects the detonator towireline 24 be shorted. If shorted, any power on the wireline would beapplied directly to the detonator and can cause it to fire (or releaseif the Switch Unit is a Switch Unit on, for instance, a mechanicalrelease device) off depth, for example. To prevent accidental firing (orrelease), a non-intrusive, low current level status check 174 is made ofthe switch to assure that it is OFF and not shorted before applyingpower.

Those skilled in the art will recognize that if the Switch Unit controlsa detonator, the detonator can include all types, such as hot wiredetonators, exploding foil initiators, exploding bridge wire detonators,and semiconductor bridge detonators. In addition, the Switch Unitsdescribed herein can be integrated into the body of such detonators asshown in FIG. 15 for safer handling at the surface because applicationof accidental power will not cause the detonator to fire. Also, anintegrated detonator needs only three wires compared to five wires for aseparate Switch Unit connected to a detonator. Power can only be appliedto the detonators after the proper communication sequence isestablished. The embodiment in FIG. 15 shows a Switch Unit that isintegrated with a detonator having a negative shooting polarity (ascompared to a positive shooting polarity shown in FIG. 14A). Theintegrated components include all parts of the Switch Unit along withwhatever parts are required for the detonator of choice.

In an alternative embodiment, the interrogation-response communicationssystem of the present invention does not use addressing between thesurface computer and the downhole Switch Units. In this alternativeembodiment, the surface computer and power supply are typically the sameas used in ordinary perforating jobs, but different software is used forthe communication protocol that tracks the number of uplink and downlinkmessages and the state machine position within each Switch Unit. FIGS.16A and 16B are flow charts describing the program control sequence forinitializing a three gun string and firing the bottom gun in accordancewith this alternative embodiment of the present invention.

The process begins at the time the Surface Unit sends power down thewireline. The Surface Unit then sends a State (0) command to the topSwitch Unit (3). After receiving the first message, the top Switch Unit(3) validates the message. Upon receiving a valid message, the StateMachine advances within the top Switch Unit (3). If the messagevalidation is error free, Switch Unit (3) uplinks a message containingswitch status, State Machine status, and a security check word. If aninvalid message is received, the Switch Unit uplinks an invalid responsemessage. Upon receiving the first uplink message from Switch Unit (3),the surface computer validates the message, verifies the status of theState Machine, and switches and downlinks a W/L ON command. If theSwitch Unit sends an error message or the uplink message was invalid inany way, the power to the gun string is removed and the processrestarted. Upon receiving the second downlink message, the State Machineadvances within the top Switch Unit (3). If the Message validation iserror free, the Switch Unit (3) turns the W/L Switch ON, uplinks amessage containing switch status, State Machine status, and a securitycheck word and then goes into hibernation. The action of turning W/LSwitch ON within Switch Unit (3) allows wireline power to be applied toSwitch Unit (2). If an invalid message was receive, the Switch Unituplinks an invalid message response with no other action. Upon receivingthe second uplink message from Switch Unit (3), the surface computervalidates the message and verifies the status of the State Machine andthe switches, completing the communication to Switch Unit (3). SwitchUnit (3) then goes into hibernation.

The following process begins a first time communication to Switch Unit(2). The surface computer sends the first message, a State (0) commandto the middle Switch Unit (2). Switch Unit (2) now receives andvalidates its first message. Upon receiving a valid message, the StateMachine advances within the middle Switch Unit (2). If the messagevalidation is error free, Switch Unit (2) uplinks a message containingswitch status, State Machine status, and a security check word. If aninvalid message is received, the Switch Unit uplinks an invalid responsemessage. Upon receiving the first uplink message from Switch Unit (2),the surface computer validates the message, verifies the status of theState Machine and then switches and downlinks a W/L ON command. If theSwitch Unit sends an error message or the uplink message was invalid inany way, the power to the gun string is removed and the processrestarted. The middle Switch Unit (2) receives and validates the seconddownlink message. Upon receiving a valid message, the State Machineadvances within middle Switch Unit (2). If the message validation iserror free, the Switch Unit (2) turns the W/L Switch ON, uplinks amessage containing switch status, State Machine status, and a securitycheck word and then goes into hibernation. With the action of turningW/L Switch ON with Switch Unit (2), wireline power is applied to SwitchUnit (1). If an invalid message is received, the Switch Unit uplinks aninvalid message response. Upon receiving the second uplink message fromSwitch Unit (2), the surface computer validates the message, verifiesthe status of the State Machine and the switches, completing thecommunication to Switch Unit (2). Switch Unit (2) then goes intohibernation.

The following process begins a first time communication with Switch Unit(1). The Surface Unit sends the first message, a State (0) command tothe bottom Switch Unit (1), which receives and validates its firstmessage. Upon receiving a valid message, the State Machine advanceswithin bottom Switch Unit (1). If the message validation is error free,Switch Unit (1) uplinks a message containing switch status, StateMachine status, and a security check word. If an invalid message isreceived, Switch Unit (1) uplinks an invalid response message. Uponreceiving the first uplink message from Switch Unit (1), the surfacecomputer validates the message, verifies the status of the StateMachine, and switches and downlinks an ARM ON command. If an errormessage was sent or the uplink message was invalid, power to the gunstring is removed and the process restarted.

Upon receiving the second downlink message, the state machine advanceswithin the bottom Switch Unit (1). If the message validation is errorfree, the Switch Unit (1) turns the ARM Switch ON, uplinks a messagecontaining switch status, State Machine status, and a security check. Ifan invalid message is received, the Switch Unit uplinks an invalidmessage response. Upon receiving the second uplink message from SwitchUnit (1), the surface computer validates the message, verifies status ofthe State Machine and the switches and downlinks a FIRE ON command. Ifan error message was sent or the uplink message was invalid in any way,power to the gun string is removed and the process restarted. Uponreceiving the third downlink message, the state machine advances withinthe bottom Switch Unit (1). If the message validation is error free, theSwitch Unit (1) turns the FIRE Switch ON, uplinks a message containingswitch status, State Machine status, and a security check. If an invalidmessage is received, the Switch Unit uplinks an invalid messageresponse. Upon receiving the third uplink message from Switch Unit (1),the surface computer validates the message, verifies the status of theState Machine and the switches. All conditions are now met to send powerfor detonation of the bottom gun. Following detonation, power is removedfrom the wireline and the gun string is repositioned for firing gun (2),which is now the bottom gun. On a gun string of (n) guns, the process isrepeated for each gun. Again, no addressing is required.

Those skilled in the art will recognize that there are severalvariations on this method. One variation is for the top Switch Unit tosend an automatic uplink message after being powered up containing aState (0) status, State Machine status, and a security check word. Thesurface computer records and validates the message and returns adownlink command to advance the State Machine to State (1), which turnsthe W/L Switch ON. The top Switch Unit then sends a second uplinkmessage containing a State (1) status that is verified at the surface.Applying power to the next Switch Unit wakes it up and triggers anautomatic uplink message of its current State (0) status. The uplink isdelayed to allow the second uplink message to be received first at thesurface. The second Switch Unit is then commanded from the surface toadvance to State (1), and so forth until the bottom Switch Unit islocated and power sent to detonate the bottom perforating gun. Byrecognizing the change in state of each Switch Unit as it iscommunicated, the surface computer uniquely identifies each Switch Unitin the perforating gun string.

FIG. 17 describes an embedded State Machine within each Switch Unitalong with its pre-defined sequence of events. Upon power-up, the StateMachine begins in State (0) and waits for the first downlink message.After receiving the first message, the State Machine advances from State(0) to State (1) and tests the message sent for correct bit count,content, and cyclic-redundancy-check (CRC). If the first message isinvalid, the State Machine advances from State (1) to State (8) anduplinks an invalid message status, alerting the surface computer andcausing the Switch Unit to progress to a permanent hold state waitingfor power to be removed. If the first message is valid, the StateMachine advances from State (1) to State (2) and uplinks a messagecontaining valid message status and waits in State (2) for the seconddownlink message. After receiving the second downlink message, the StateMachine advances from State (2) to State (3) and tests the secondmessage sent for correct bit count, content, and cyclic-redundancy-check(CRC). If the second message is invalid, the State Machine advances fromState (3) to State (9) and uplinks an invalid message status, alertingthe surface computer and causing the Switch Unit to progress to apermanent hold state waiting for power to be removed. If the secondmessage is verified, the received command bits must be decoded. The twolegal commands for the second downlink message are a W/L ON command oran ARM ON command. If the Switch Unit decodes a W/L ON command, theState Machine advances from State (3) to State (4). While in State (4),the Switch Unit turns the W/L Switch ON, uplinks a valid status messageand then goes into hibernation. The Switch Unit is not allowed toreceive any further commands. If the Switch Unit decodes an ARM ONcommand, the State Machine advances from State (3) to State (5) andturns the ARM Switch ON, uplinks a valid status message and waits for athird downlink message. After receiving the third downlink message, theState Machine advances from State (5) to State (6) and again the messageis validated for content. If an error is detected in the third downlinkmessage, the State Machine advances from State (6) to State (10) anduplinks an invalid message status, alerting the surface computer andcausing the Switch Unit to progress to a permanent hold state waitingfor power to be removed. If a valid third downlink message is decodedalong with a valid FIRE ON command, the State Machine advances fromState (6) to State (7). While the State Machine is in State (7), theswitch unit sets the FIRE Switch to ON, uplinks a valid status message,and waits for the firing voltage to be applied to the wireline.Application of the firing voltage causes the detonator to fire. Othererror trapping as known to those skilled in the art may also be used inaccordance with the method of the present invention. An alternativeembodiment follows the same logic except that any uplink message alsocontains a unique address specific to a particular Switch Unit. Theaddress is pre-programmed into the State 10 Machine during manufacturingof the circuit, providing additional confirmation of the position of anindividual Switch Unit within the tool string.

In the following paragraphs, an interrogation-response communicationbetween the surface computer and the downhole Switch Units is describedthat uses common commands for all downlink interrogations. The surfacecomputer and power supply are typically the same as used in ordinaryperforating jobs and the communication protocol is implemented withappropriate software. All Switch Units respond to a common specificprotocol for the downlink interrogation. A unique address is retrievedfrom each individual switch unit as a result of a downlink interrogationand is transmitted back up to the surface computer. In this embodiment,downlink commands do not contain the address of the switch, making thecommands shorter and quicker than if they did.

FIG. 18 shows a flow chart describing a sequence of events for shootingtwo guns in a string. The first event occurs when the surface controllersends power down the wireline. The second event occurs when the surfacecomputer interrogates the top switch using a common sequence. The firstdownlink transmission includes a State (0) command in order to sync thesurface computer with the Switch Unit. The embedded state machine withineach Switch Unit allows the surface computer to track the sequence ofcommands to all Switch Units in the entire string. After receiving thefirst message, the top Switch Unit validates the message. If thedownlink message is free of errors, the top Switch Unit advances theState Machine, loads its embedded unique address, and uplinks a messagecontaining switch status, state machine status, address information anda security check word. If the downlink message contains errors, theSwitch Unit advances the state machine and uplinks an invalid messageresponse identifying the detected error. This error trapping is repeatedfor any invalid receive message for a switch unit. For clarity, thisroutine will not be repeated in the remaining paragraphs of thisdescription of the communication/control protocol of the presentinvention.

The surface computer receives and validates the first uplink messagefrom the top Switch Unit. State Machine status is compared to expectedresults and the unique address is recorded. The surface computer thensends a second downlink containing a W/L ON command. If the Switch Unitsent an error message or the uplink message was invalid in any way, thepower to the gun string is removed and the process restarted. The topSwitch Unit receives and validates the second downlink message. If avalid message is received, the Switch Unit advances the State Machine,turns the W/L Switch ON, loads the embedded unique address for the topSwitch Unit, and uplinks a message containing switch status, StateMachine status, address information, and a security check word. The topSwitch Unit then goes into hibernation. With the W/L switch turned ON,the second Switch Unit in the string is now powered. The surfacecomputer verifies the [mal uplink message from the top Switch Unit,which includes State Machine and switch status and the unique address ofthe Switch Unit, completing the sequence for the top Switch Unit. Thesurface computer now interrogates the second Switch Unit, the firstinterrogation to the second Switch Unit including a State (0) command.After receiving the first message, the second Switch Unit validates themessage. If the downlink message is free of errors, the second SwitchUnit advances the State Machine, loads the embedded unique address, anduplinks a message containing switch status, state machine status,address information, and a security check word. If the downlink messagecontains errors, the Switch Unit advances the State Machine and uplinksan invalid message response identifying the detected error. The surfacecomputer receives and validates the first uplink message from the secondSwitch Unit, compares State Machine status to expected results, andrecords the unique address. The surface computer sends a second downlinkcontaining ARM ON command. If the Switch Unit sent an error message orthe uplink message was invalid in any way, the power to the gun stringis removed and the process restarted.

The second (bottom) Switch Unit receives and validates the seconddownlink message. If a valid message is received, the Switch Unitadvances the State Machine, turns the AM Switch ON, loads the embeddedunique address for the second Switch Unit, and uplinks a messagecontaining switch status, state machine location, address informationand a security check word. The surface computer receives and validatesthe second uplink message from the second (bottom) Switch Unit. StateMachine status and unique address are compared to expected results andthe surface computer sends a third downlink message containing a FIRE ONcommand. If the Switch Unit sent an error message or the uplink messagewas invalid in any way, the power to the gun string is removed and theprocess restarted. The second (bottom) Switch Unit receives andvalidates the third downlink message. If a valid message is received,the Switch Unit advances the State Machine, turns the FIRE Switch ON,loads the embedded unique address for the second Switch Unit, anduplinks a message containing switch status, state machine location,address information, and a security check word. The surface computerreceives and validates the third uplink message from the second (bottom)Switch Unit. State Machine status and unique address are compared toexpected results, and if all status and address data is correct, thesurface power supply is allowed to send shooting voltage to the secondswitch and the bottom gun detonates.

Those skilled in the art will recognize that there are severalvariations on this sequence. One variation is for the top Switch Unit tosend an automatic uplink message containing a State (0) status, StateMachine status, the unique embedded address for the top Switch Unit, anda security check word after being powered up. The surface computerrecords and validates the message and returns a downlink command toadvance the State Machine to State (1), which turns the W/L Switch ON,which powers the next Switch Unit, which then automatically uplinks amessage containing a State (0) status, State Machine status, the uniqueembedded address, and a security check word, and so on until the bottomSwitch Unit is reached and firing power applied to detonate the gun.

In the preceding paragraphs, selective perforating with Switch Unitscontrolling power access to detonators was described. FIG. 19A shows atop level system having a combination of parallel and serial controlunits for perforating. The difference is that serial control units areelectrically connected in any command sequence that accesses aparticular unit below them. Parallel units need not be connected toaccess units below them. The parallel units are shown on top of thestring in FIG. 19A although they could be located anywhere in thestring, e.g. between series control units, below the series units or anygeneral placement. One parallel Control Unit is used in conjunction witha Release Device. Another parallel Control Unit is used for monitoring aplurality of sensors. These sensors include, but are not limited to,such functions as acceleration, downhole voltage, downhole current,inclination and rotational positioning, temperature, and pressure.Included in the serial string is a single control unit for detonating aperforating gun. The actual number of serial control units forperforating guns can be one or more. Another service uses a serialcontrol unit for igniting a Setting Tool.

Another version of the application of parallel/series communication isfor conveyance of well logging tools by a tractor as shown in FIG. 19B.A Control Unit located at the tractor allows electrical power to beselected by command to either power the tractor or the logging tools.One or more auxiliary tractor tools (millers, cleaners, strokers, forinstance), each with their own Control Unit and identified genericallyas “select ID1,” “select ID2,” etc. at reference numeral 130A, 130B,etc. can be selected and powered individually. The Control Units for thetractor and the auxiliary tractor tools are connected electrically inparallel Those skilled in the art who have the benefit of thisdisclosure will recognize that a particular auxiliary tractor tool 130A,130B, etc. may have two or more Control Units connected in series. FIG.19B also shows two or more logging tools 132A, 132B connectedelectrically in parallel that can be individually powered by eitherpositive or negative DC voltage from the surface, as detailed in FIG.19C. One or more safety subs are located below the tractor to preventaccidental tractor power from reaching logging tools 132A, 132B. Eachsafety sub contains its own Control Unit that allows electricalconnection upon command from the surface.

FIG. 20 shows a method for communicating with microprocessor/statemachines that have both parallel and serial Control Units on thewireline as shown in FIGS. 19A and 19B. In the method illustrated, eachstate machine or device has a plurality of its own set of legalcommands. Upon receiving a message, the receiving controller decodes theembedded command. Only if the command is legal is the receivingcontroller allowed to generate an uplink message preventing busscontention or collision of data whenever two or more remote units are ona buss or party line connection. In addition, before an uplinktransmission can occur, the logical position of the state machine iscompared and must be in sync with the expected state positiontransmitted by the host. This comparison further discriminates whichmessages are legal and which controllers are allowed to return an uplinkmessage. In another embodiment, an identifier, either unique or commonto that type of tool, is attached to each uplink or returned message todistinguish one type of tool from another. Those skilled in the art willrecognize that these methods apply to each of the controllers within theparallel and serial systems shown in FIGS. 19A and 19B.

Referring to FIG. 20, the Surface Unit first applies power to thewireline, causing all control units on the communication buss toinitiate a power-up reset and enter state “0” waiting for a downlinkmessage. The Surface Unit then sends a downlink message containing aplurality of commands specific to only one controller along with a state“0” status. Every downhole controller then receives and verifies themessage for errors. If an error is detected, the downhole controllergoes back to state “0” with no further action. If the message is errorfree, the state machine advances and the command bits within the messageare decoded. If the command is illegal, the downhole device reverts tostate “0.” If the command is legal for a particular device the statemachine again advances, uplinks a message, and waits for a secondresponse.

The Surface Unit then receives and validates the first uplink message.If the message is in error, the Surface Controller goes into a restartmode by turning power OFF and then back ON for a fresh start. If themessage is error free, the Surface Controller transmits a second messagecontaining the same control command along with the state machineexpected position. Again, all remote control units receive the secondmessage and only the one controller matching the downlink state positionand having received a legal command is allowed to advance and processthe message. If the message is verified and an error exists, then a badmessage status is returned and the downhole device must be powered downto continue. If the message is verified to free of errors, the commandis processed and a return (uplink) confirmation message is transmitted.The Surface Controller receives and validates the message, and if themessage contains errors, the Surface Controller restarts the entireprocess. If the message is error free, the Surface Controller acceptsthe data and continues to the next command or next control unit.

FIG. 21 illustrates a predefined sequence of events for each controlunit on the buss connected in either parallel or serial and containingone or more microprocessors or state machines as referred to in FIGS.19A, 19B and 20. Upon power-up, the state machine enters state “0” andwaits for a downlink message. Upon receiving a message from the surface,the state machine advances to state “I”. While in state “1,” the messageis validated for proper state position, cyclic-redundancy-check, andmessage length. If an invalid message is decoded by the microprocessor,the state machine reverts to state “0.” If a valid message is decoded,the state machine advances to state “2.” While in state “2,” the commandbits are decoded. If an illegal command is decoded for that particularcontroller, the state machine again goes back to state “0.” If a legalcommand is decoded, the device returns a message containing state “3,”the decoded command, all status, embedded address (if used) andcyclic-redundancy-check. The device now waits for a second downlinkmessage. Upon receiving a second downlink message the state machineadvances to state “4.” While in state “4,” the control unit verifiesreceiving the proper state position from the surface controller, againcompares the command bits with the previous command bits,cyclic-redundancy-check, and message length. If the message is invalidin any way, the state machine advances to state “6” and the downholecontroller transmits an uplink message confirming an invalid message. Atthis point, the control unit must be powered down to restart. If themessage is valid, the state machine advances to state “5.” While instate “5,” the control unit processes the command. For the last event,the control unit transmits an uplink message including state “5”position, all status, embedded address (if used), andcyclic-redundancy-check. The State Diagram in FIG. 21 shows themicroprocessor/state machine entering a sleep mode following a commandand will not listen to any more messages until a complete restart aswould be the case for a serial connected control unit, but a parallelconnected control unit may wait for additional commands and mayor maynot enter the sleep mode.

Those skilled in the art who have the benefit of this disclosure willrecognize that changes can be made to the component parts and steps ofthe present invention without changing the manner in which thoseparts/steps function and/or interact to achieve their intended result.Several examples of such changes have been described herein, and thoseskilled in the art will recognize other such changes from thisdisclosure. All such changes are intended to fall within the scope ofthe following, non-limiting claims.

What is claimed is:
 1. A method of communicating with a switch unitlocated on a perforating gun, release device, or explosive device forlowering into a wellbore comprising the steps of: sending a command tothe switch unit; identifying the status of a switch with a state machinewithin the switch unit; identifying one or more valid commands for thestatus of the switch with the state machine; determining whether thecommand is valid for the status of the switch with the state machine; ifthe command is invalid, returning a signal comprising an error messagefrom the switch unit at a current level in the range of from about 4milliamps to about 15 milliamps; if the command is valid, controllingthe position of the switch; and if the command is valid, returning asignal validating switch status from the switch unit at a current levelin the range of from about 4 milliamps to about 15 milliamps.
 2. Themethod of claim 1 wherein the return signal further comprises the statusof the switch.
 3. The method of claim 1 wherein the return signalfurther comprises an identifier for the switch unit.
 4. The method ofclaim 1 additionally comprising the step of lowering the perforatinggun, release device, or explosive device into the wellbore and returninga signal from the switch unit at a current level in the range of fromabout 10 milliamperes to about 100 milliamperes.
 5. A method ofswitching between a safe mode for tractoring and a perforating mode forperforating in a tool string including a tractor and a perforating gunfor lowering into a wellbore on a wireline comprising the steps of:sending a signal to a control unit on the tractor from the surface;identifying the status of a switch with a state machine within theswitch unit; identifying one or more valid commands for the status ofthe switch with the state machine; determining whether the command isvalid for the status of the switch with the state machine; if thecommand is invalid, returning a signal comprising an error message fromthe control unit; if the command is valid, controlling the position ofthe switch to connect the wireline to either the tractor motor or athrough wire connecting to the perforating gun while blocking negativevoltage below a predetermined threshold through the wireline; and if thecommand is valid, returning a signal validating switch status to thesurface.
 6. The method of claim 5 wherein the tool string additionallyincludes a safety sub between the tractor and the perforating gun andnegative voltage is blocked at the output of the safety sub.
 7. Themethod of claim 5 wherein the return signal comprises an identifier forthe control unit.
 8. The method of claim 5 wherein the return signalcomprises the status of the switch.